CVE-2026-42272highCWE-178CWE-436

CVE-2026-42272: high-severity vulnerability in dadrus heimdall

Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

Published

Follow this CVE+ Monitor heimdall+ Monitor github.com/dadrus/heimdall

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.8epss 0.4%
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Affected products
dadrus · heimdall
Related CVEs — dadrus heimdall

In the same product, most dangerous first.

CVE-2026-57209HIGHHeimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy ModeEPSS 0.5%CVE-2026-42274HIGHHeimdall: Authorization bypass via path normalization mismatchEPSS 0.4%CVE-2026-32811HIGHHeimdall: Path received via Envoy gRPC corrupted when containing query stringEPSS 0.3%CVE-2026-57210HIGHHeimdall: IP Spoofing via Unvalidated Forwarding HeadersEPSS 0.3%CVE-2026-42273HIGHHeimdall: Case-sensitive host matching may lead to policy bypassEPSS 0.3%